Justin Cappos
where else to find them
what they talk about
all 5 in the filters
where they keep going back
- KubeCon + CloudNativeCon Europe3 editions2018–2025
- KubeCon + CloudNativeCon North America2 editions2019–2022
all 10 in the filters
on a stage with
all 19 in the filters
who talks about the same things
- Marina Moore37 talks
- Joshua Lock12 talks
- Santiago Torres-Arias14 talks
- Kairo De Araujo5 talks
- Aditya Sirish A Yelgundhalli9 talks
- Asra Ali7 talks
| title | conference | date |
|---|---|---|
| SBOMs Aren't Enough. Secure Your Software Supply Chain End-To-End | Open Source Summit Korea 2026 | 2026-08-11 |
SBOMs only inventory components and do not stop tampering; SLSA identifies nine distinct threat areas from source to distribution. The demo stitches gituff… | ||
| SBOMit: Making SBOMs Accurate With Attestations | KubeCon + CloudNativeCon Japan 2026 | 2026-07-29 |
SBOMit generates SBOMs from in-toto attestations captured by witness at build time, observing filesystem reads/writes, process execution and network fetches… | ||
| Thinking About Source Code Security in New Ways | Open Source SecurityCon Europe 2026 | 2026-03-23 |
Gittuf is a client-side security layer for Git that embeds policy, keys and an append-only reference state log inside repo refs so every clone can verify… | ||
| Moving Academia Toward Practice Through Accreditation | Open Source SecurityCon North America 2025 | 2025-11-10 |
A joint CNCF/OpenSSF accreditation program defines 10 topic areas (cloud fundamentals and software supply chain security), requires a 7–10 page application, a… | ||
| Your SBOM Is Lying To You – Let’s Make It Honest | Open Source Summit Europe 2025 | 2025-08-25 |
Current SBOMs routinely miss runtime artifacts and build-time inclusions; SBOMit captures build activity with in-toto attestations, records file and… | ||
| Attesting and Verifying Your Software Supply-Chain With In-toto | KubeCon + CloudNativeCon Europe 2025 | 2025-04-01 |
in-toto provides cryptographic attestations for build steps and a layout language that enforces who may run each step; a production-ready toolchain includes… | ||
| In-Toto: Protecting Software Supply Chain in Cloud Native and Application in Confid... | KubeCon + CloudNativeCon + Open Source Summit China 2023 | 2023-09-26 |
In-toto defines a JSON layout that lists steps, who holds keys, and allowed inputs/outputs, then produces per-step signed links/attestations that prove the… | ||
| TUF-En Up Your Signatures | KubeCon + CloudNativeCon North America 2022 | 2022-10-24 |
TUF is a compromise‑resilient update framework used by sigstore, Notary and Google Fuchsia that limits damage when repositories or signing keys are breached… | ||
| Using TUF to Mitigate Repository Compromises | KubeCon + CloudNativeCon North America 2019 | 2019-11-18 |
TUF (The Update Framework) presents a concrete design to limit damage from repository compromises by using threshold signatures, periodic root key rotation… | ||
| Securing the Software Supply Chain with in-toto | KubeCon + CloudNativeCon North America 2019 | 2019-11-18 |
in-toto provides an explicit supply-chain model that declares steps, participants and accepted inputs then records what actually happens using layout and link… | ||
| Using TUF and in-toto to Tighten the Release Process. | KubeCon + CloudNativeCon North America 2019 | 2019-11-18 |
Describes a concrete pipeline hardening: use TUF to enforce root / targets / snapshot / timestamp roles with separated keys, threshold signing and built-in… | ||
| Intro: TUF / Notary | KubeCon + CloudNativeCon Europe 2019 | 2019-05-20 |
TUF (spec) and Notary (Go implementation) provide signed metadata, automatic recovery from stolen keys, and practical revocation so a compromised server or… | ||
| Deep Dive: TUF / Notary | KubeCon + CloudNativeCon Europe 2019 | 2019-05-20 |
TUF provides compromise resilience for software updates with self-revocation and key rotation so delegated keys can revoke or replace themselves without every… | ||
| Deep Dive: CNCF Security SIG – Justin Cappos, New York University & Zhipeng Huang, Huawei | KubeCon + CloudNativeCon Europe 2019 | 2019-05-20 |
CNCF Security SIG performs public, high-level security assessments (20–30 hours to draft, ~1–2 engineer weeks total) of projects like TUF/Notary, SPIRE/SPIFFE… | ||
| TUF / Notary Project Intro | KubeCon + CloudNativeCon Europe 2018 | 2018-05-02 |
TUF provides a compromise-resilient key roles model (root, targets, snapshot, timestamp) that separates duties so key rotation and revocation work without… | ||
| TUF / Notary Deep Dive | KubeCon + CloudNativeCon Europe 2018 | 2018-05-02 |
TUF defines a JSON metadata hierarchy — root/timestamp/snapshot/targets — with canonical serialization, expiring versions, delegated keys and path… | ||
| CHAINIAC: Proactive Software-Update Transparency... | 26th USENIX Security Symposium (USENIX Security '17) | 2017-08-16 |
CHAINIAC builds a decentralized update pipeline where independent witness servers collectively verify source-to-binary correspondence and produce a single… | ||
| On Omitting Commits and Committing Omissions: Preventing Git Metadata... | USENIX Security '16 | 2016-08-10 |
Catalogs seven metadata-manipulation attacks and demonstrates how tampering with Git reference files enables subtle exploits like teleport attack and rollback… | ||
| nothing matches | ||